The vulnerability allows an attacker to obtain sensitive information through error messages that include internal paths, file names, tokens, credentials, error codes, and stack traces. This can expose the system’s architecture and provide an attacker with valuable information for planning further attacks. The weakness is classified as CWE-209, which involves the accidental display of sensitive data in an error condition.

Affected systems include HCL Traveler from HCLSoftware. No specific version information is provided in the available data, so all current installations of HCL Traveler are considered at risk until a patch or mitigation is applied.

The CVSS score of 4.3 indicates low to medium severity, and the EPSS score is under 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, which further suggests it is not actively exploited by major threat actors. The most probable attack vector is through the application’s web interface, where error responses are returned to the client. If an attacker can trigger specific errors, they may receive detailed messages. As no direct exploitation is provided, the risk remains primarily informational.